How to use ZeroDrift

The public ZeroDrift API is a short workflow: obtain a bearer token, upload a zip archive, create an audit session from that upload, poll status, and read findings. The public API does not expose GitHub repository selection; use direct zip uploads for external integrations.

Base URL

https://zerodrift.xyz/api

Send the same bearer token on every protected request:

Authorization: Bearer <token>

Run an audit

A normal integration moves through four steps. Keep the ids returned at each stage because the next request depends on them.

1. Get a token. Generate or copy a bearer token from your ZeroDrift account.
2. Upload source. Send a zip archive to POST /api/audit/upload; the response returns upload_id.
3. Create the session. Call POST /api/audit/sessions with { "uploadId": "..." }.
4. Read results. Poll GET /api/audit/sessions/:sessionId/status, then fetch GET /api/audit/sessions/:sessionId/findings.

Upload uses normal multipart form data.

export TOKEN="<token>"
export ZIP="/path/to/protocol.zip"

# 1. Upload a zip
curl -X POST "https://zerodrift.xyz/api/audit/upload" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file=@$ZIP"

# 2. Create an audit session from the upload id
curl -X POST "https://zerodrift.xyz/api/audit/sessions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"uploadId":"upl_123"}'

# 3. Poll status, then read findings
curl "https://zerodrift.xyz/api/audit/sessions/$SESSION_ID/status" \
  -H "Authorization: Bearer $TOKEN"

curl "https://zerodrift.xyz/api/audit/sessions/$SESSION_ID/findings" \
  -H "Authorization: Bearer $TOKEN"

The upload response uses upload_id, while the session creation request uses uploadId.

Errors and access

Most integration problems surface as standard HTTP status codes.

Session-level endpoints enforce ownership checks before returning data, so a token can only read sessions it created.